Virtual Keyboard and Mouse Input easily detectable? menu

User Tag List

Results 1 to 7 of 7
  1. #1
    aeon0's Avatar Member
    Reputation
    14
    Join Date
    Nov 2021
    Posts
    21
    Thanks G/R
    0/8
    Trade Feedback
    0 (0%)
    Mentioned
    2 Post(s)
    Tagged
    0 Thread(s)

    Virtual Keyboard and Mouse Input easily detectable?

    So, I have done some research and played around with Windows API for keyboard and mouse actions. Here is basically what I got so far (there is a question at the end! )

    keybd_event and SendInput will insert keystroke messages directly in the input stream of the keyboard or mouse. These events are at first glance very much like any other keyboard or mouse action, but when you hook to them e.g. with SetWindowsHookEx(WH_KEYBOARD_LL, ...) they will have the LLMHF_INJECTED set. Removing this flag can only be done on driver level (so writing your own keyboard and mouse driver) because the hooks are all read-only. Changing the lParam has no effect on the next hook. Basically, warden can monitor all your keyboard inputs -> If stuff happens in-game and it only sees actions with LLMHF_INJECTED for some minutes -> bot. Seems quite unsafe to me.

    Another possibility is PostMessagen and SendMessage. This will send custom messages directly to the input stream of a window. These messages will not have the LLMHF_INJECTED flag set. But they will also not trigger any WH_KEYBOARD_LL hooks. It could be detected by checking if hooks are triggered while stuff happens in-game. Thus, also not hard to detect.

    All options using the available Windows API seem to be super easy to detect. Imho the only options to be safe (at least in this regard), is by writing your own driver or having a hardware keyboard emulated (e.g. with a raspberry pi or arduino).

    Any thoughts on this? I am led to believe I am missing something, because I am surprised botting is a thing in any game giving how easy it is to detect virtual input with the Windows API.
    And if you would have to decide to either use SendInput() vs PostMessage(), what would you go for?
    Last edited by aeon0; 11-01-2021 at 02:57 AM.

    Virtual Keyboard and Mouse Input easily detectable?
  2. Thanks Razzue (1 members gave Thanks to aeon0 for this useful post)
  3. #2
    Razzue's Avatar Contributor Avid Ailurophile

    CoreCoins Purchaser Authenticator enabled
    Reputation
    379
    Join Date
    Jun 2017
    Posts
    588
    Thanks G/R
    184/268
    Trade Feedback
    2 (100%)
    Mentioned
    14 Post(s)
    Tagged
    0 Thread(s)
    I personally use PostMessage() so I don't need to have wow as topmost, the one thing that drove me nuts with SendInput()..
    THOUGH (and don't quote me on this, can't verify if fact or opinion) I've been told SoM beta client has new checks for Post/Send Message() that are not used as of this moment.

  4. #3
    aeon0's Avatar Member
    Reputation
    14
    Join Date
    Nov 2021
    Posts
    21
    Thanks G/R
    0/8
    Trade Feedback
    0 (0%)
    Mentioned
    2 Post(s)
    Tagged
    0 Thread(s)
    Thanks for the answer. PostMessage for keyboard is fine. PostMessage for mouse gave me some issues because for mouse movement it seems GetCursorPos() is called which will return the "real" cursor position.
    Thus I can operate my bot using PostMessage but will have a "jumping mouse". Also couldn't a anti-cheat program not just check if GetCursorPos() == Click event from PostMessage()?

    I decided I will go down the arduino road. Costs $ but should be rather safe from detection.

  5. #4
    Razzue's Avatar Contributor Avid Ailurophile

    CoreCoins Purchaser Authenticator enabled
    Reputation
    379
    Join Date
    Jun 2017
    Posts
    588
    Thanks G/R
    184/268
    Trade Feedback
    2 (100%)
    Mentioned
    14 Post(s)
    Tagged
    0 Thread(s)
    Ahh, for mouse movement I can't really say much, I don't bother sending fake mouse input to wow... I just write Unit/Object GUID to mouseover GUID address then send interact with mouseover key to wow 🤷*♂️, and for movement just send wasd for x amount of ms based on current location/rotation in comparison to destination position/rotation 🤔
    Last edited by Razzue; 11-03-2021 at 02:57 AM.

  6. #5
    Hazzbazzy's Avatar wannabe hackerlol Authenticator enabled
    Reputation
    1335
    Join Date
    Aug 2011
    Posts
    1,206
    Thanks G/R
    243/484
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by aeon0 View Post
    So, I have done some research and played around with Windows API for keyboard and mouse actions. Here is basically what I got so far (there is a question at the end! )

    keybd_event and SendInput will insert keystroke messages directly in the input stream of the keyboard or mouse. These events are at first glance very much like any other keyboard or mouse action, but when you hook to them e.g. with SetWindowsHookEx(WH_KEYBOARD_LL, ...) they will have the LLMHF_INJECTED set. Removing this flag can only be done on driver level (so writing your own keyboard and mouse driver) because the hooks are all read-only. Changing the lParam has no effect on the next hook. Basically, warden can monitor all your keyboard inputs -> If stuff happens in-game and it only sees actions with LLMHF_INJECTED for some minutes -> bot. Seems quite unsafe to me.

    Another possibility is PostMessagen and SendMessage. This will send custom messages directly to the input stream of a window. These messages will not have the LLMHF_INJECTED flag set. But they will also not trigger any WH_KEYBOARD_LL hooks. It could be detected by checking if hooks are triggered while stuff happens in-game. Thus, also not hard to detect.

    All options using the available Windows API seem to be super easy to detect. Imho the only options to be safe (at least in this regard), is by writing your own driver or having a hardware keyboard emulated (e.g. with a raspberry pi or arduino).

    Any thoughts on this? I am led to believe I am missing something, because I am surprised botting is a thing in any game giving how easy it is to detect virtual input with the Windows API.
    And if you would have to decide to either use SendInput() vs PostMessage(), what would you go for?
    Very easily detectable via GetCurrentInputMessageSource function (winuser.h) - Win32 apps | Microsoft Docs - driver is the correct solution.
    "HOLY TIME MACHINE BATMAN! it's 1973!"
    https://youtube.com/Hazzbazzy

  7. #6
    lobuz87's Avatar Member
    Reputation
    1
    Join Date
    Jan 2021
    Posts
    6
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by Razzue View Post
    Ahh, for mouse movement I can't really say much, I don't bother sending fake mouse input to wow... I just write Unit/Object GUID to mouseover GUID address then send interact with mouseover key to wow 🤷*♂️, and for movement just send wasd for x amount of ms based on current location/rotation in comparison to destination position/rotation 🤔
    can you explain how u do the wasd based on current to det position ?

  8. #7
    frey12354's Avatar Member CoreCoins Purchaser
    Reputation
    1
    Join Date
    Apr 2022
    Posts
    2
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by Razzue View Post
    I personally use PostMessage() so I don't need to have wow as topmost, the one thing that drove me nuts with SendInput()..
    THOUGH (and don't quote me on this, can't verify if fact or opinion) I've been told SoM beta client has new checks for Post/Send Message() that are not used as of this moment.
    Doesnt that just get detected now tho ? , i havent checked since multiboxing ban since didnt wanna risk my account. If there is a way to make it undetectable it'd be awesome if you could give me a direction to check also sorry about this question but whats SoM ?

Similar Threads

  1. [Question] Replaying recorded keyboard/mouse input
    By 42stein in forum WoW Bots Questions & Requests
    Replies: 4
    Last Post: 08-30-2021, 08:47 AM
  2. [Question] Botting only solution is to use second computer and mouse/keyboard/visual translation
    By milkshake4u3 in forum WoW Bots Questions & Requests
    Replies: 0
    Last Post: 11-19-2017, 05:36 PM
  3. Play World of Warcraft Both On Retail And Private Servers Easily.
    By AngshumanSSJV in forum World of Warcraft Guides
    Replies: 9
    Last Post: 01-10-2009, 03:40 AM
  4. (Exploit\trick) Flying without using the keyboard and mouse!
    By dragoonman in forum World of Warcraft Exploits
    Replies: 19
    Last Post: 07-04-2008, 12:41 AM
  5. Get Your Virtual Haircut and Other Auditory Illusions
    By SkinTicket in forum Community Chat
    Replies: 3
    Last Post: 08-28-2007, 05:08 AM
All times are GMT -5. The time now is 09:04 PM. Powered by vBulletin® Version 4.2.3
Copyright © 2024 vBulletin Solutions, Inc. All rights reserved. User Alert System provided by Advanced User Tagging (Pro) - vBulletin Mods & Addons Copyright © 2024 DragonByte Technologies Ltd.
Digital Point modules: Sphinx-based search